Reinforced security for the Thalys train service in Brussels.
Photograph: Stephanie Lecocq/EPA

Security was stepped up on major European rail services as fears of “blowback” attacks by jihadis returning from Syria escalated after a gunman known to the intelligence agencies opened fire on a high-speed train bound for Paris.

The name of the gunman was confirmed by French police as Ayoub el-Khazani, a 25-year-old Moroccan, known to Belgian, French and Spanish authorities, who travelled to fight in Syria last year, prompting the belief that the attack was linked to Islamic State.

French authorities were questioning Khazani at their counter-terrorism headquarters outside Paris as remarkable details continued to emerge of how the heavily armed gunman was overpowered by passengers on the train in France.

A photograph reported by television channel France 2 to be of Ayoub el-Khazani. Photograph: Facebook

A Briton, and two US servicemen, one of whom suffered knife wounds in the struggle to subdue the Kalashnikov-carrying attacker, were among those who wrestled him to the ground after he had boarded in Brussels. Within hours of the thwarted attack, security measures on the high-speed Thalys trains between France, Belgium, the Netherlands and Germany were upgraded with increased patrols and baggage checks at international rail stations.

French police confirmed the gunman’s identity and said he was known to intelligence services as a radical Islamist who went to Syria in 2014.

The office of Charles Michel, Belgium’s prime minister, also confirmed that Khazani was known to Belgian authorities and they had been informed by Spain that he was a security risk. It also emerged that the he may have lived in France before travelling to Syria.

Bernard Cazeneuve, the French minister of the interior, says the individual arrested could be a Moroccan man who Spanish intelligence services warned French police about in 2014

What is known is that before his attack he travelled to Belgium’s busiest station – the terminus of the Eurostar rail link to Britain, Brussels’ Gare du Midi – to board the train.

Security experts have repeatedly warned of “blowback” – the term used to describe the rebound of violence from one area to another – and say the terrorist threat posed by European jihadis who have fought in Syria or Iraq returning home is significant.

A spokesman for Europol, the EU’s police agency, said on Saturday that Europeans returning from Iraq and Syria presented the “most serious terrorist threat Europe has faced since 9/11”.

The agency’s latest assessment indicates that as many as 5,000 Europeans have joined the fighting in Syria, posing a potentially significant risk to their native countries. This includes around 600 Britons, 1,200 French nationals and at least 350 Belgians, the latter giving the country the largest contingent of foreign fighters relative to the size of its Muslim population.

Until the confirmation that Khazani was the gunman, the only case of Isis “blowback” in Europe had been Mehdi Nemmouche, a 29-year-old French national of Algerian origin who has been charged with attacking the Brussels Jewish Museum in May 2014. Nemmouche had spent more than a year in Syria, and police found links to Isis.

France train shooting: gunman 'had been in Syria and was known to intelligence services'

Read more

Bernard Cazeneuve, France’s interior minister, said that Spanish authorities had initially alerted French intelligence services in February 2014 to Khazani because of his connections to the radical Islamist movement.

In response, French authorities placed him on the country’s state security “S-list”, which identifies suspects noted for “links with terrorism”, although not all are placed under surveillance. Raffaello Pantucci, a counter-terrorism expert, said there was a “high probability” that Khazani had forged links to Isis. Claude Moniquet, the chief executive of the European Strategic Intelligence and Security Centre, agreed that he was “very probably linked to Islamic State”.

Others pointed out the similarities with the recent attack in the Tunisian beach resort of Sousse in which a gunman, also armed with an AK-47, killed 38 people, mainly British tourists.

The French newspaper La Voix du Nord claimed that Khazani may have had connections with a group involved in a suspected Islamist shooting in Belgium in January. On 8 January, 24 hours after the attacks at Charlie Hebdo in Paris, Belgian police killed two suspected Islamist extremists and arrested a third. The suspects were allegedly on the point of carrying out an attack.

It was announced that President Barack Obama had called Spencer Stone, Aleksander Skarlatos and Anthony Sadler to commend and congratulate them for their “courage and quick action aboard their Paris-bound train last night”.

Video shot on a mobile phone shows the moments after three US citizens, two of whom were military personnel, overpowered a gunman on a high-speed train travelling between Amsterdam and Paris

The president expressed his gratitude to the three for “their heroic actions forestalling an even greater tragedy”. He wished Stone, who received cuts to his hands and neck, a speedy recovery, and “expressed how proud all Americans are of their extraordinary bravery”.